Central Security Service virus - How to remove

Central Security Service virus is a ransomware that was designed by cybercriminals in order to rip off random computer users. The program is installed to PCs with a help of Trojan viruses so the users would not detect it at the stage of infiltration. Once inside it blocks your entire system and does not allow to use any of your programs. Central Security Service virus displays a message on your screen that looks like this:

National Security Agency
Central Security Service
All activities on this computer has been recorded.
All your files are encrypted. Don’t try to unlock your computer!
This computer has been locked for violating the law of the United States of America.
Your Internet Service Provider in cooperation with the Internet Watch Foundation (IWF) monitors and takes action against illegal and offensive content on the Internet<…>.

As you see, it claims that all your files are encrypted due to violation of the law of the United States. The program accuses you of viewing pornographic files or breaking the law by using copyrighted content. Central Security Service virus mainly attacks computers in the United States of America. However, there are a few other versions of this ransomware that infiltrate into computers all over the world.

Central Security Service virus states that you must pay a fine of 300 USD for all the law violations your are blamed for to be removed. It also says that if you do not follow this warning, you will have to face more serious problems and may even be arrested. You should know that Central Security Service virus is a scam and you shouldn’t fall for it. It has no relations with police or any other official institutions and only uses official names and logos to get users’ trust.

Remove Central Security Service virus from your system as soon as you receive its message. If your computer has more than one user account and not all of them are locked, scan whole PC with anti-malware programs, e.g. spyhunter, by logging to the account that is not blocked. Another option is to use system restore. If none of these methods worked for you, do the following:

• Restart your computer;
• Press F8 while it is still restarting;
• Choose between safe modes in following order: Safe mode, Safe mode with command prompt

Then follow the guides below:

If your computer runs in Safe mode or Safe mode with networking

1. Launch MSConfig.
2. Disable startup items rundll32 turning on any application from Application Data;. Note, that these are typical locations for Central Security Service virus but some others might be used.
3. Restart the system once again.
4. Scan with https://www.2-viruses.com/downloads/spyhunter-i.exe to identify Central Security Service virus files and delete it.

Here is a video showing how to complete the steps:

If your computer runs in Safe mode with command prompt

1. Run Regedit.
2. Search for WinLogon Entries. Write down all files it references that are not explorer.exe or blank. Replace them with explorer.exe
3. Search registry for Central Security Service virus files and delete the registry keys referencing the files
4. Try to reboot and scan with Spyhunter.
5. If this fails, try doing system restore from safe mode with command prompt (rstrui.exe)

If none of safe modes could be launched

Some versions of Central Security Service virus disable all safe modes, but give a short gap that you can use to run anti-malware programs:

1. Reboot normally.
2. Start->Run.
3. Enter: http://2-viruses.com/downloads/spyhunter-i.exe . If malware is loaded, just press alt+tab once and keep entering the string blindly. Press Enter.
4. Press Alt+tab and then R couple times. Central Security Service virus process should be killed.

Here is a video detailing this approach:

Hitman Pro USB disk

If you did not succeed using any of the methods above, try scanning PC with a bootable USB or DVD disk. These should be able to remove all versions of Central Security Service virus, but will not work if your hard drive is encrypted.

For that, we recommend using Hitman Pro Kickstarter USB.

1. Download Hitman Pro on uninfected PC. 
2. Run Hitman and ask to create Kickstarter USB (option on initial screen)
3. When USB ready, reboot infected PC with USB attached and press DEL
4. Choose USB as primary boot device.
5. Boot normally.
6. Run Hitman Pro and https://www.2-viruses.com/downloads/spyhunter-i.exe . One of these programs should detect and remove malware from your PC.

Automatic Malware removal tools

Manual removal